[CVE-2026-62643] In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS)…

Descripción técnica

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.

Puntuación CVSS

Score: 7.2/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Productos afectados

Webmail — Roundcube

Debilidades (CWE)

CWE-918

Fuente oficial

Publicado en NIST NVD.